--- id: ATS-PFM-OPS-016 scope: CAP-PFM-OPS-016 product_area: platform module: operations revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 scenarios: - id: ATS-PFM-OPS-016-01 title: Present the administrator’s application standing level: api proves: - BR-CAP-PFM-OPS-016-01 preconditions: The customer administrator holds the application-read permission. steps: Read workspace applications. expected: 'Each application has readable identity, licence dates, operational standing and availability.' negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-081 provenance: test source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers each application with its key, name, licence state and dates, operation state and availability evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers each application with its key, name, licence state and dates, operation state and availability category: permission binding_evidence: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers each application with its key, name, licence state and dates, operation state and availability - id: ATS-PFM-OPS-016-02 title: Protect internal reasons and attribution level: api proves: - BR-CAP-PFM-OPS-016-02 preconditions: Withheld and suspended applications have internal explanations and authors. steps: Read through the customer surface. expected: Internal commercial and personal details are omitted and withhold is simplified to no licence. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-081 provenance: test source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#says a withheld application is simply not licensed, never that Rhythm withheld it evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#says a withheld application is simply not licensed, never that Rhythm withheld it category: invariant binding_evidence: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#says a withheld application is simply not licensed, never that Rhythm withheld it - id: ATS-PFM-OPS-016-03 title: Distinguish foreign workspace from missing authority level: api proves: - BR-CAP-PFM-OPS-016-03 preconditions: A foreign customer administrator and an unpermitted local user call the read. steps: Request the same application listing. expected: The foreign workspace is not found and the local caller is refused. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-081 provenance: test source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers 404, not 403, to an administrator of another customer holding the same key evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers 404, not 403, to an administrator of another customer holding the same key category: boundary binding_evidence: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers 404, not 403, to an administrator of another customer holding the same key - id: ATS-PFM-OPS-016-04 title: Show the same standing with audience-specific detail category: interaction level: api proves: - BR-CAP-PFM-OPS-013-03 - BR-CAP-PFM-OPS-016-02 exercises: - CAP-PFM-OPS-016 - CAP-PFM-OPS-013 preconditions: A reasoned withhold and a suspension are recorded for a workspace. steps: Read the staff licensing view and the customer application view. expected: The views agree on unavailability while the customer view omits internal decisions and attribution. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#tells staff the same application was withheld, which is the distinction the two answers keep; services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#says a withheld application is simply not licensed, never that Rhythm withheld it; CAP-PFM-OPS-013; - id: ATS-PFM-OPS-016-05 title: Read standing within the administrator’s reach category: interaction level: api proves: - BR-CAP-PFM-OPS-016-03 exercises: - CAP-PFM-OPS-016 - CAP-PFM-SEC-002 preconditions: Two customers have workspaces with different application standing. steps: Read the local workspace and then request the other customer’s application information. expected: The local explanation is available without exposing the other customer’s standing. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers 404, not 403, to an administrator of another customer holding the same key; CAP-PFM-SEC-002; - id: ATS-PFM-OPS-016-06 title: Keep application availability separate from personal authority category: interaction level: api proves: - BR-CAP-PFM-OPS-016-01 exercises: - CAP-PFM-OPS-016 - CAP-PFM-SEC-007 preconditions: >- A licensed ready application is available to the workspace but the person lacks its application authority. steps: Read workspace standing and request a protected action as that person. expected: The standing read does not itself grant the person permission to use a protected action. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers each application with its key, name, licence state and dates, operation state and availability; CAP-PFM-SEC-007; evidence: - >- Pinned capability rules, object invariants, state transitions and workflows are reviewed for testing obligations. - >- Executable bindings refer only to existing suites; no module executable suite runs during this documentation job. coverage: rule: 'gap: FND-PFM-OPS-068' transition: not-applicable validation: 'gap: FND-PFM-OPS-068' permission: covered edge: 'gap: FND-PFM-OPS-068' failure: 'gap: FND-PFM-OPS-068' boundary: covered concurrency: 'gap: FND-PFM-OPS-068' invariant: covered interaction: covered coverage_notes: rule: No distinct general rule case is categorized here. transition: >- This capability reads records without changing their lifecycle; transitions belong to the writing capabilities. validation: Invalid input and rejected configuration need dedicated proof. edge: 'Empty, missing and unusual inputs need dedicated proof.' failure: Injected dependency failures need dedicated proof. concurrency: >- No controlled overlapping execution proves the capability’s read or write behavior while related state changes. related_capabilities: - CAP-PFM-OPS-013 - CAP-PFM-SEC-002 - CAP-PFM-SEC-007 workflow_interactions: [] coverage_obligations: finding: FND-PFM-OPS-068 uncovered_must_prove: [] object_invariants_requiring_explicit_trace: - INV-DOM-PFM-OPS-004-01 - INV-DOM-PFM-OPS-004-02 - INV-DOM-PFM-OPS-004-03 - INV-DOM-PFM-OPS-004-04 - INV-DOM-PFM-OPS-004-05 - INV-DOM-PFM-OPS-004-06 - INV-DOM-PFM-OPS-004-07 - INV-DOM-PFM-OPS-004-08 related_scenarios: - capabilities: - CAP-PFM-OPS-016 - CAP-PFM-OPS-013 scenario: ATS-PFM-OPS-016-04 - capabilities: - CAP-PFM-OPS-016 - CAP-PFM-SEC-002 scenario: ATS-PFM-OPS-016-05 - capabilities: - CAP-PFM-OPS-016 - CAP-PFM-SEC-007 scenario: ATS-PFM-OPS-016-06 unbound_scenarios: - ATS-PFM-OPS-016-04 - ATS-PFM-OPS-016-05 - ATS-PFM-OPS-016-06 transition_review: [] permission_review: - key: platform.tenant-applications.read where_checked: api provenance: unknown source: FND-PFM-OPS-068 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. gap_detail: >- Disabled workspaces, malformed read requests, failed customer reads and refresh during access changes need dedicated proof beyond the normal response and scope checks. workflow_scenarios: {} --- # Explain application availability to a customer administrator: Capability Test Specification ## Coverage The category map distinguishes authored scenarios from unresolved proof obligations. A bound scenario names an existing executable suite; its recorded result remains unrun. | Rule | Proof status | |---|---| | `BR-CAP-PFM-OPS-016-01` | `ATS-PFM-OPS-016-01`, `ATS-PFM-OPS-016-06` | | `BR-CAP-PFM-OPS-016-02` | `ATS-PFM-OPS-016-02`, `ATS-PFM-OPS-016-04` | | `BR-CAP-PFM-OPS-016-03` | `ATS-PFM-OPS-016-03`, `ATS-PFM-OPS-016-05` | ## Interactions With Related Capabilities Show the same standing with audience-specific detail. The views agree on unavailability while the customer view omits internal decisions and attribution. Read standing within the administrator’s reach. The local explanation is available without exposing the other customer’s standing. Keep application availability separate from personal authority. The standing read does not itself grant the person permission to use a protected action. ## Evidence and Boundaries Pinned assertion sources support the listed executable bindings. Proposed cases retain the proof required beyond those boundaries. Structured obligations name incomplete object, transition and permission trace; row-level concurrency proof does not establish complete workflow serialization.